Win64.Ransom.A (B) removal tips

The Win64.Ransom.A (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win64.Ransom.A (B) virus can do?

Sample contains Overlay data
Authenticode signature is invalid

How to determine Win64.Ransom.A (B)?


File Info:
name: B5E90B2B1700F201D353.mlw
path: /opt/CAPEv2/storage/binaries/4e0546d79592fa39d69883987a258a92d24b84a35afeeb979e595e485daaf3a2
crc32: C54AF29F
md5: b5e90b2b1700f201d3538038248c880d
sha1: 7729c15254f7d4d27730a24788cb1a2a87688dc4
sha256: 4e0546d79592fa39d69883987a258a92d24b84a35afeeb979e595e485daaf3a2
sha512: af951e61ae89fb2f79af138348118839b443744b674d4df03f0ee1102841a04cfce23231042231e007aba768203eac36de3bd1d18996b480e2911f84e9a90233
ssdeep: 6144:5qrJdQvNwIypT+D4ElxgsYIxW3+WOMjvEV4UcVp35cia:5Od02IypT+DZlqAxWtjcV+VnLa
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T149941A256AC0692BF5739236CAA18641FF3677634722C33B74C8463F1F77185AA33626
sha3_384: bb7d26e925010a940c36c2dae728e000d3b6caf28ba301293976f4a925143eb9e267e5b526ac7009e61c033a9d2b03ee
ep_bytes: 488d05c6fbffff4805c5020000ffd0c8
timestamp: 2010-09-30 17:49:43

Version Info:
CompanyName: Microsoft Corporation
FileDescription: qualauncher
FileVersion: 10.0.17134.10074 (WinBuild.160101.0800)
InternalName: qualauncher
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: qualauncher
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.17134.10074
Translation: 0x0409 0x04b0

Win64.Ransom.A (B) also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Win64.Ransom.A
ALYac	Win64.Ransom.A
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_70% (D)
Cyren	W64/Expiro.BM.gen!Eldorado
ESET-NOD32	a variant of Win64/Expiro.DR
Kaspersky	VHO:Trojan-PSW.Win32.Stealer.gen
BitDefender	Win64.Ransom.A
Ad-Aware	Win64.Ransom.A
Emsisoft	Win64.Ransom.A (B)
VIPRE	Win64.Ransom.A
FireEye	Win64.Ransom.A
GData	Win64.Ransom.A
Google	Detected
MAX	malware (ai score=89)
Arcabit	Win64.Ransom.A
Cynet	Malicious (score: 100)
Acronis	suspicious
Fortinet	W64/Expiro.DR!tr

How to remove Win64.Ransom.A (B)?

Win64.Ransom.A (B) removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X